EVV Compliance for Medicaid HCBS Providers: The Complete Guide

What Is EVV and Why Does Federal Law Require It?

Electronic Visit Verification (EVV) is a technology system that records six specific facts about every Medicaid-funded home care visit at the moment the visit takes place. It was written into federal law in December 2016 through the 21st Century Cures Act, which required states to implement EVV across all Medicaid personal care services and home health care services or face reductions in their federal funding.

The rationale was straightforward. Before EVV, home care visits were verified through paper timesheets and caregiver attestations, both of which were easy to falsify. CMS estimated that fraudulent billing for services never delivered cost Medicaid billions annually. EVV shifts verification from paper records to real-time electronic data: when a caregiver clocks in at a client's address on their phone, the system captures the location, the time, and the caregiver's identity in the same moment.

For Medicaid HCBS providers, EVV changed the compliance burden in a specific way. Billing compliance used to be about submitting the right codes. Now it requires that every claim be matched against an electronic visit record before the state will pay it. A shift without a matching EVV entry is not a missing form; it is a rejected claim.

The 6 Required EVV Data Elements

The 21st Century Cures Act specifies six data elements that every EVV system must electronically capture for each Medicaid-funded personal care or home health care visit, with no exceptions. Systems that miss any of these elements do not meet federal requirements.

How States Implement EVV: Three Models

While EVV is a federal requirement, each state decides how to implement it. CMS recognizes several models, three of which are most common: the open model, the closed or state-mandated model, and the aggregator model. Which model your state uses determines which software your agency can use, or must use.

• Open model (provider choice). Your agency selects and funds its own EVV vendor, provided the system meets federal requirements and can transmit data to any state aggregator. California and Colorado operate open models. In open states, agencies have more flexibility to choose software that fits their workflows. The tradeoff: agencies are responsible for verifying their vendor's compliance with state-specific requirements.
• Closed or state-mandated model. The state contracts with a single EVV vendor and requires all providers to use it. Illinois, for example, mandated HHAeXchange as the EVV system for home health care services billing by December 31, 2023. In closed states, agencies have no vendor choice for the core EVV function, though some states allow agencies to use an alternate front-end system provided they integrate with the mandated platform.
• Aggregator or hybrid model. Agencies can use different front-end EVV systems but must transmit all visit data to a state-designated aggregator. The aggregator (often Sandata, HHAeXchange, or a state-built system) becomes the record of truth for billing validation. In aggregator states, your care management software must have a certified integration with the state's specific aggregator. Check this before selecting any platform.

Two additional models exist: managed care plan (MCP) choice, where the MCO selects the EVV system for its contracted providers, and state-built in-house systems where the state develops its own platform. In MCP environments, a provider contracted with multiple MCOs may need to use multiple EVV systems.

What Non-Compliance Actually Costs

For Medicaid HCBS providers, EVV non-compliance has two direct financial consequences: claim rejections on individual visits, and exposure to state audit actions that can escalate to contract consequences. For states, the 21st Century Cures Act imposes escalating FMAP reductions that states pass as compliance pressure to providers.

Claim rejections are immediate. When a provider submits a Medicaid claim without a matching EVV visit record, the claim is rejected. No EVV entry means no payment, regardless of whether the visit actually happened. A caregiver who forgets to clock in, or clocks in from the wrong location, creates a billing gap that requires manual resolution before the claim can be processed. At scale, even a 5% missed clock-in rate produces meaningful revenue delays.

The FMAP penalty schedule is escalating. States that do not implement EVV face annual reductions in their Federal Medical Assistance Percentage. For personal care services, the reduction reached its maximum of 1% annually starting in 2023. For home health care services, the reduction schedule started at 0.25% for 2023 and 2024, increases to 0.50% in 2025, 0.75% in 2026, and reaches 1% annually from 2027 onward. These reductions are applied per calendar quarter, not per year, which means a state that achieves compliance mid-year can reduce its penalty exposure for remaining quarters.

State-level enforcement varies, but the direction is tightening. Texas requires that claims not be paid without matching EVV visit transactions. Illinois set a 75% EVV compliance threshold for home health care services providers by September 30, 2025, with quarterly monitoring and escalating remediation for non-compliance. North Carolina, as of early 2025, was actively implementing billing options tied to EVV data. The pattern across states is consistent: EVV compliance thresholds are rising, and the tolerance for exceptions is shrinking.

How Software Automates EVV Capture

EVV-compliant care management software captures all six required data elements automatically at the time of each visit, then connects that data directly to the billing workflow. The goal is to remove manual data entry from the process entirely, reducing both administrative burden and the risk of errors that cause claim rejections.

Telephony as a backup. Not every care setting has reliable smartphone access. In these situations, IVR-based telephony check-in, where the caregiver calls from the client's landline, serves as an EVV method. A complete EVV system supports both GPS mobile and telephony methods, so agencies are not blocked from serving clients in connectivity-limited environments.

What to Look for in EVV-Compliant Care Management Software

Medicaid HCBS agencies should verify these capabilities before committing to any care management platform. Software that misses even one of these items creates compliance exposure that shows up either as rejected claims or as gaps in an EVV audit.

• ✓Captures all 6 EVV data elements at the time of service, not retroactively. The visit record must be created in real time. Systems that allow backdating of clock-ins as a normal workflow are a compliance risk.
• ✓GPS-verified clock-in and clock-out via a mobile app. Location must be recorded at both ends of the visit using device GPS, not entered manually or assumed from schedule data.
• ✓Telephony (IVR) backup for visits without smartphone access. Some clients do not allow phones in their home, or visits occur in areas without reliable data coverage. IVR backup is a compliance requirement in some states, not a nice-to-have feature.
• ✓Certified integration with your state's EVV aggregator. Confirm the vendor has an active, tested integration with the specific aggregator your state uses (Sandata, HHAeXchange, AuthentiCare, CareBridge, or your state's in-house system). Ask for the integration confirmation in writing.
• ✓Automated timesheet population from verified visit data. Clock-in/out data should flow directly into timesheets without manual re-entry. Any manual override must be logged with a supervisor justification, creating an audit trail for EVV exception handling.
• ✓EVV exception alerts before billing, not after rejection. The system should flag missed clock-ins, location exceptions, and time variances proactively, surfacing them for supervisor review and resolution before the claim is submitted.
• ✓Authorization tracking against EVV records. The system should cross-check billed units against the client's current authorization. Billing more units than authorized is a compliance failure that EVV data makes visible.
• ✓Audit-ready EVV record export. Complete visit records with timestamps must be exportable for state audit requests. Confirm the export format meets your state's specific requirements.
• ✓Offline clock-in capability with sync on reconnection. In areas with intermittent connectivity, the mobile app must queue the clock-in locally and sync when the device reconnects. Clock-ins that fail silently due to connectivity are a compliance gap.
• ✓Proactive compliance alerts for upcoming credential issues. EVV compliance is connected to worker eligibility. The system should alert coordinators when a caregiver's credentials are approaching expiry, so no expired worker is assigned to a Medicaid-funded shift.
• ✓Clear audit trail for all manual edits. When EVV records are corrected (for example, a genuine clock-in failure), the correction must be logged with who made the change, when, and why. A clean audit trail for exceptions is as important as preventing exceptions in the first place.

How TakeCareOS Supports EVV and HCBS Compliance

TakeCareOS is an AI-native operating system for home care, disability, and aged care agencies, with compliance tooling built specifically for Medicaid HCBS frameworks in the United States and NDIS in Australia. Its EVV-related features are designed around the gap between compliant visit capture and audit-ready billing records.

Specific capabilities relevant to Medicaid HCBS EVV compliance:

• GPS clock-in and clock-out. Support workers clock in and out through the TakeCareOS mobile app. The app captures GPS coordinates at both events, tying each visit to a verified location and time. Location data is only recorded during the active shift window. Clock-ins from outside the scheduled service address are flagged immediately for coordinator review, before they affect billing.
• AI timesheet variance review. At the end of each pay period, Atlas reviews timesheet data and flags variances between scheduled hours and verified clock-in/out times. Ask Atlas “which timesheets have unresolved exceptions this week?” and the answer comes back with the specific shifts, the nature of each variance, and the workers involved. Coordinators review and approve before any claim is submitted.
• Compliance alerts. The Alerts module surfaces missed clock-ins, clock-ins from outside the shift location, unsigned documents, and expiring worker credentials. These alerts appear before a billing run, not after a rejection. Compliance as a continuous state, not a pre-billing scramble.
• Audit-ready documentation. All visit records, timesheets, shift notes, and supporting documents are stored in a centralised system with a full version history and timestamp trail. When a state auditor requests records for a specific date range or client, the records are retrievable in one place, not scattered across email threads and spreadsheets.
• AI form filling and document automation. Atlas can fill EVV-adjacent documentation from shift data and participant context, reducing the manual re-entry that creates discrepancies between visit records and billing forms. Build any required state form as a digital template; Atlas fills it from the data already in the system.

TakeCareOS is built to support Medicaid HCBS compliance frameworks. For agencies operating under NDIS requirements in Australia, the same platform handles NDIS compliance. See also: NDIS Compliance for Providers: What the Auditors Actually Check. For a primer on the broader Medicaid HCBS funding landscape, see: What Is Medicaid HCBS? A Guide for Home Care Agency Owners.

Frequently Asked Questions

TakeCareOS: the AI-native operating system for HCBS providers

TakeCareOS is built ground-up for home care, disability, and aged care agencies navigating Medicaid HCBS and NDIS compliance. One platform where Atlas, your AI assistant, verifies shift data, flags timesheet variances, surfaces compliance exceptions, and keeps records audit-ready as a continuous state. GPS clock-in/out, automated billing, compliance alerts, and a conversational interface that lets your team manage operations in plain English.

See it in action